What exactly do you get access to?
The honest answer, per cloud. The first scan uses a read-only role you deploy from a published template. Every action below is a describe, list, or get — this page renders the actual list, so it can never drift from what we deploy.
AWS — read-only IAM role
82 actions · published as CloudFormation & TerraformYou deploy a role that trusts our account under an external id we generate per connection (prevents the confused-deputy problem). We hold only the role ARN and external id and re-assume it read-only on each sync — no long-lived credentials are stored.
82 read-only actions, parsed from the exact CloudFormation template we publish — this page is drift-guarded by tests.
Not ready to grant a role? Bring one month of CSV bill data — the Day-0 audit runs without credentials, inside the design partner programme.
Cost Explorer & billing
13 actionsRead spend, tags, commitment coverage, and AWS's own purchase recommendations — the numbers behind every figure.
ce:GetCostAndUsagece:GetCostForecastce:GetReservationCoveragece:GetReservationUtilizationce:GetSavingsPlansCoveragece:GetSavingsPlansUtilizationce:GetSavingsPlansUtilizationDetailsce:GetReservationPurchaseRecommendationce:GetSavingsPlansPurchaseRecommendationce:GetTagsce:GetDimensionValuesce:DescribeCostCategoryDefinitionce:ListCostCategoryDefinitionsUtilization metrics
3 actionsRead CloudWatch CPU (avg/p95/max) so rightsizing evidence is measured, not guessed.
cloudwatch:GetMetricDatacloudwatch:GetMetricStatisticscloudwatch:ListMetricsCompute & storage inventory
12 actionsDescribe EC2 instances, EBS volumes, Elastic IPs, NAT gateways, and snapshots for the idle-resource sweep and topology.
ec2:DescribeReservedInstancesec2:DescribeInstancesec2:DescribeInstanceTypesec2:DescribeVolumesec2:DescribeAddressesec2:DescribeNatGatewaysec2:DescribeSnapshotsec2:DescribeImagesautoscaling:DescribeAutoScalingGroupslambda:ListFunctionslambda:ListProvisionedConcurrencyConfigsapplication-autoscaling:DescribeScalableTargetsDatabase inventory
19 actionsDescribe RDS, ElastiCache, OpenSearch, Redshift, and DynamoDB for rightsizing and idle detection.
rds:DescribeDBInstancesrds:DescribeDBClustersrds:DescribeReservedDBInstancesdynamodb:ListTablesdynamodb:DescribeTabledynamodb:DescribeTimeToLivedynamodb:ListTagsOfResourceelasticache:DescribeCacheClusterselasticache:DescribeReplicationGroupselasticache:DescribeReservedCacheNodeselasticache:ListTagsForResourcees:ListDomainNameses:DescribeDomaines:DescribeDomainses:DescribeElasticsearchDomaines:DescribeElasticsearchDomainses:ListTagsredshift:DescribeClustersredshift:DescribeReservedNodesObject-storage configuration
7 actionsList buckets and read their lifecycle/tiering configuration (config only — never object contents).
s3:ListAllMyBucketss3:GetBucketLocations3:GetBucketTaggings3:GetBucketVersionings3:GetLifecycleConfigurations3:GetBucketIntelligentTieringConfigurations3:GetInventoryConfigurationOrganizations hierarchy
8 actionsRead the account/OU tree so multi-account spend rolls up. Degrades gracefully on member accounts.
organizations:DescribeOrganizationorganizations:ListRootsorganizations:ListOrganizationalUnitsForParentorganizations:ListAccountsForParentorganizations:ListAccountsorganizations:ListParentsorganizations:DescribeAccountorganizations:DescribeOrganizationalUnitAWS-native optimizer findings
16 actionsImport AWS's own recommendations (Cost Optimization Hub, Compute Optimizer, Trusted Advisor) — read-only, only where you've opted in.
cost-optimization-hub:ListRecommendationscost-optimization-hub:GetRecommendationcost-optimization-hub:ListEnrollmentStatusescompute-optimizer:GetEnrollmentStatuscompute-optimizer:GetRecommendationSummariescompute-optimizer:GetEC2InstanceRecommendationscompute-optimizer:GetAutoScalingGroupRecommendationscompute-optimizer:GetEBSVolumeRecommendationscompute-optimizer:GetLambdaFunctionRecommendationscompute-optimizer:GetECSServiceRecommendationscompute-optimizer:GetRDSDatabaseRecommendationstrustedadvisor:ListRecommendationstrustedadvisor:GetRecommendationsupport:DescribeTrustedAdvisorCheckssupport:DescribeTrustedAdvisorCheckResultsupport:DescribeTrustedAdvisorCheckSummariesBroad resource discovery
3 actionsOne tagging-API sweep plus CloudFront so the infrastructure map covers more of the estate without per-resource describes.
cloudfront:ListDistributionscloudfront:GetDistributiontag:GetResourcesIdentity check
1 actionsConfirm which account the role landed in (sts:GetCallerIdentity) — no other identity access.
sts:GetCallerIdentityOptional: Cost & Usage Report (CUR) access
Attached only if you point us at a CUR S3 bucket — it gives line-item-grade billing. Without it we use the Cost Explorer API above.
This is the only policy that can write, and only inside the CUR bucket you designate: Athena writes its query results (scratch output) there to run. It never writes to any other resource, and it reads only your billing-export files — not application data.
s3:GetObjects3:GetObjectVersions3:ListBuckets3:GetBucketLocationathena:StartQueryExecutionathena:StopQueryExecutionathena:GetQueryExecutionathena:GetQueryResultsathena:GetWorkGroupglue:GetTableglue:GetTablesglue:GetDatabaseglue:GetDatabasesglue:GetPartitionglue:GetPartitionsglue:BatchGetPartitions3:PutObjects3:AbortMultipartUploads3:ListMultipartUploadPartsOptional: activity evidence (CloudTrail lookup + VPC Flow Logs)
Turns idle-resource findings from an inference into evidence. With it, CloudJaeger can say “no principal called this in 30 days” and “we measured 412 GB of cross-AZ traffic” instead of reasoning from CPU alone — and it can attribute a finding to the identity that last touched the resource.
Not granted? Nothing breaks and nothing is guessed. Access-based findings simply do not appear, transfer figures render as an em-dash (never $0.00), and the coverage panel states which permission is missing.
CloudTrail lookup
Reads the 90-day management-event history through the LookupEvents API. No trail is created, no S3 export is required, and we never read your CloudTrail bucket.
cloudtrail:LookupEventsVPC Flow Log source (choose the one you already use)
Reads flow-log records from the CloudWatch Logs group or the S3 prefix you designate — scoped to that one destination, not to your account's logs or buckets in general. CloudJaeger never enables flow logging for you; that would be a write and it would add cost to your bill.
logs:FilterLogEventslogs:DescribeLogGroupss3:GetObjects3:ListBucketNetwork topology reads
Security groups and network interfaces are the unused-SG and detached-ENI checks; subnets supply the CIDR-to-availability-zone map without which the intra-AZ / cross-AZ byte split cannot be resolved at all.
ec2:DescribeSecurityGroupsec2:DescribeNetworkInterfacesec2:DescribeSubnetsWhat this data cannot tell you
- CloudTrail lookup reaches back 90 days at most, and covers MANAGEMENT events only — object reads, Lambda invocations and DynamoDB item reads are invisible unless you have enabled data events on a trail.
- Because of that, CloudJaeger never calls an EC2 instance or database idle from CloudTrail silence: those serve traffic without calling an AWS API. Silence is only treated as evidence for resources whose use IS an API call.
- Reads are budgeted and rate-limited on our side. A scan that does not finish its window is recorded as truncated, and no “nobody used this” conclusion is drawn from it.
- Flow-log figures cover only interfaces where flow logging is enabled, so measured bytes are a floor, never a ceiling.
- Everything stays read-only and advisory. No finding is ever applied automatically.
Azure — service principal, reader roles
You register an app (“CloudJaeger Cost Reader”) and assign it two built-in Azure roles. Neither can write.
Cost Management ReaderReads spend data via the Azure Cost Management query API.
ReaderLists the subscription's resources through Azure Resource Graph, reads Azure Monitor utilization metrics for the rightsizing panel on the connection page (live metrics stay off until an operator enables them), and Azure Advisor recommendations. If Cost Management is unavailable, we still connect for inventory with Reader alone.
Reservations ReaderReads your reservation orders (Microsoft.Capacity) so reservation coverage and utilization are measured. Without it reservation inventory is reported unavailable, naming this role.
Management Group ReaderReads the management-group hierarchy (Microsoft.Management) so subscriptions roll up in the organization tree. Without it the tree cannot show management groups.
GCP — service account, viewer roles
Cost comes from your BigQuery billing export, not the Billing API. The service account gets read-only viewer roles and read-only OAuth scopes.
roles/billing.viewerConfirm the billing account's name and status (metadata only — cost itself is read from the export).
roles/bigquery.dataViewerRead the billing-export dataset — the cost line items themselves.
roles/bigquery.jobUserRun the read-only query that pulls the export.
roles/cloudasset.viewerDiscover the full project resource inventory through Cloud Asset Inventory; without it, inventory falls back to the service lists your existing read permissions allow.
roles/compute.viewerList Compute Engine resources and committed-use discounts for inventory, idle detection and commitment coverage.
roles/monitoring.viewerRead Cloud Monitoring CPU utilization for the rightsizing panel on the connection page. Live metrics stay off until an operator enables them.
roles/recommender.viewerImport Google Cloud Recommender's own recommendations.
roles/browserRead the organization → folder → project hierarchy for the organization tree.
OAuth scopes
https://www.googleapis.com/auth/cloud-billing.readonlyhttps://www.googleapis.com/auth/bigquery.readonlyhttps://www.googleapis.com/auth/compute.readonlyhttps://www.googleapis.com/auth/monitoring.readhttps://www.googleapis.com/auth/cloud-platform.read-onlyhttps://www.googleapis.com/auth/cloud-platformWhat CloudJaeger never touches
- No write to your infrastructure — the read-only role describes, lists, and gets; it never creates, modifies, or deletes a resource. Two opt-in exceptions write only where you point them: the optional CUR add-on writes Athena scratch into the CUR bucket you designate (see below), and — if you configure an export destination — the scheduled export writes the dataset into your own S3 bucket, Snowflake table, or BigQuery table using the separate credential you supply for it. This read-only role is not used for that export, and with no destination configured nothing is written anywhere.
- No application data — no database rows, no message queues, no object contents. (The optional CUR add-on reads only your billing-export files.)
- No logs or secrets by default — the standard role reads no CloudTrail, no log group, no Secrets Manager value and no KMS key material. Only if you opt into the separate activity add-on do we read the 90-day CloudTrail management-event LOOKUP and the one flow-log destination you designate — never a trail export, never your log bucket at large, never application logs, and never a secret.
- No agents or code in the cloud connection — it installs nothing: we assume a role and call read APIs. The optional Kubernetes agent is a CronJob you install in your own cluster; it reads your Prometheus and posts daily usage to us.
- No standing AWS credentials stored — for AWS we hold only the role ARN + external id and re-assume each sync.
Off-boarding & data lifecycle
Delete the role, service principal, or key any time — the next sync fails and the connection stops. That is full off-boarding, in your hands.
- Delete the role (or service principal / key) any time — from then on every read we attempt is refused and no new data arrives. The connection's card says its last sync failed; an AWS role that refuses us on two separate nightly runs is marked Needs attention and the nightly sync stops trying it. Deleting the connection here also removes the cost data stored for it. Security posture →
- Data retention, export, and deletion are covered in the Data Processing Agreement. Data Processing Agreement →
- What we collect and why is in the Privacy Policy. Privacy Policy →
- Controls, audit trail, and sub-processors are on the Trust & Security center. Trust & Security →
Read-only first, deletable any second.
Every request is reviewed by hand. Start with a read-only pilot and keep the findings report either way.
